University of Wisconsin–Madison

Section III: Human Subjects Protection and HIPAA Compliance

Although not everyone at IRP works with confidential data or directly with research subjects, IRP expects employees to understand the rules regulating the protection of human research subjects.

Required UW Human Subjects Training (CITI)

The human subjects protection training, offered online by the University of Wisconsin–Madison, helps with everyday awareness of how certain information is used and distributed in order to minimize the risks to human subjects in research.

If your project(s) constitutes human subjects research, which means the project must be approved by a UW (IRB) Institutional Review Board, you are required to complete the online training.

For more information and the link to the training, see:


Additionally, the UW requires that all individuals listed on human subject protocols required to fill out an annual Outside Activities Report (OAR) and update whenever new outside activities are undertaken.

Link to VCRGE Outside Activities Reporting:


NON-UW COLLABORATORS: You do NOT need to complete the UW course, but can provide certification of human subjects training from your own institution.  OARs are required only of UW students, staff, and faculty.

Required UW HIPAA Training (Canvas)

For all individuals who access IRP directory space on Silo, as well as all project PIs, the UW HIPAA training must be completed.

IRP space on Silo contains data with Protected Health Information.  Not all projects or individuals have access to this type of data file.  However, because PHI data are stored on the server, IRP is requiring all those with Silo access (to IRP directories) to take the UW HIPAA training.

The HIPAA training must be renewed annually.

While IRP is not within the UW Health Care Component (HCC), the UW Privacy Office holds our researchers using PHI to the same standards applied to those within the HCC.

Self-enrollment for the HIPAA training is no longer available.
If you are not already registered for the course in Canvas, the IRP Data Security Officer can send a registration request to the Office of Compliance — you will then receive a course registration notice from the Canvas system.


NON-UW COLLABORATORS: You do NOT need to complete the UW course, but can provide certification of HIPAA training from your institution. If your institution does not offer training, please visit this page to complete the UW’s version of HIPAA training for non-UW researchers.

Check your UW human subjects and HIPAA training status using the Research Certification Lookup

With the understanding that WinLDS users of IRP data will need to complete UW HIPAA training, and likely the UW human subjects training and an OAR, please continue to SECTION IV of the manual.